[
https://issues.apache.org/jira/browse/METRON-1289?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16251562#comment-16251562
]
ASF GitHub Bot commented on METRON-1289:
----------------------------------------
Github user cestella commented on a diff in the pull request:
https://github.com/apache/metron/pull/824#discussion_r150868283
--- Diff:
metron-platform/metron-indexing/src/main/java/org/apache/metron/indexing/dao/HBaseDao.java
---
@@ -135,8 +138,9 @@ private Document getDocumentFromResult(Result result)
throws IOException {
Map.Entry<byte[], byte[]> entry= columns.lastEntry();
Long ts = Bytes.toLong(entry.getKey());
if(entry.getValue()!= null) {
- String json = new String(entry.getValue());
- return new Document(json, Bytes.toString(result.getRow()), null, ts);
+ Map<String, Object> json = JSONUtils.INSTANCE.load(new
String(entry.getValue()), new TypeReference<Map<String, Object>>() {
+ });
+ return new Document(json, Bytes.toString(result.getRow()), (String)
json.get(SOURCE_TYPE), ts);
--- End diff --
I will amend my constant briefly in that I don't like the first option
there as the major flaw in all of these designs is coupling the ES logic within
HBase logic. I think given this is all going away after ES 5 (IMO), we should
probably just use the existing abstractions used in the writers to handle field
name transformations here where we need to transform field names.
> Alert fields are lost when a MetaAlert is created
> -------------------------------------------------
>
> Key: METRON-1289
> URL: https://issues.apache.org/jira/browse/METRON-1289
> Project: Metron
> Issue Type: Bug
> Reporter: Ryan Merriman
> Assignee: Ryan Merriman
>
> When a MetaAlert is created, the included results are being updated
> incorrectly with only the "metaalert" field. This causes subsequent findOne
> operations to only return the "metaalert field for that alert. All fields
> should continue to be present.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
